A) Is nsITimer the right thing to use or is there something better?
Yeah, it's the right one, like bsmedberg said.
B) Can anyone point me at an example of how to use nsITimer?
http://lxr.mozilla.org/seamonkey/source/extensions/inspector/base/src/inSearchLoop.cpp#61 is an example from the DOM inspector code. All you have to do is init the timer, and it will fire as specified.
C) I don't think nsITimer comes as part of the Gecko SDK - is that correct?
Yes, the SDK only contains frozen interfaces.
smime.p7s
Description: S/MIME Cryptographic Signature
